CVE-2026-47291

HTTP.sys Remote Code Execution Vulnerability

Exploitation likely. EPSS gives it a 25% chance of exploitation in the next 30 days. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile98th25% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products9 fixed builds listed below

Check it yourself

OpenVAS · 16 checks

e.g. OID 1.3.6.1.4.1.25623.1.3.0.10816.0.5094122.494846484649525157514657505152

Run the check

Published 2026-06-09Updated 2026-07-23Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 1607Affected: ≥ 10.0.14393.0, < 10.0.14393.9234Upgrade to: 10.0.14393.9234Affected: ≥ 10.0.17763.0, < 10.0.17763.8880Upgrade to: 10.0.17763.8880Affected: ≥ 10.0.19044.0, < 10.0.19044.7417Upgrade to: 10.0.19044.7417Affected: ≥ 10.0.19045.0, < 10.0.19045.7417Upgrade to: 10.0.19045.7417Stated by: CVE record
Microsoft Windows 11 version 23H2Affected: ≥ 10.0.22631.0, < 10.0.22631.7219Upgrade to: 10.0.22631.7219Affected: ≥ 10.0.26100.0, < 10.0.26100.8655Upgrade to: 10.0.26100.8655Affected: ≥ 10.0.26200.0, < 10.0.26200.8655Upgrade to: 10.0.26200.8655Affected: ≥ 10.0.28000.0, < 10.0.28000.2269Upgrade to: 10.0.28000.2269Stated by: CVE record
Microsoft Windows Server 2016Affected: ≥ 10.0.14393.0, < 10.0.14393.9234Upgrade to: 10.0.14393.9234Stated by: CVE record
Microsoft Windows Server 2019Affected: ≥ 10.0.17763.0, < 10.0.17763.8880Upgrade to: 10.0.17763.8880Stated by: CVE record
Microsoft Windows Server 2022Affected: ≥ 10.0.20348.0, < 10.0.20348.5256Upgrade to: 10.0.20348.5256Stated by: CVE record

Versions as the sources state them. 3 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Update affected Windows systems to the newest available security updates from Microsoft as a top priority. 2) If you can’t patch immediately, restrict network access to those servers/workstations (especially from the internet) and block unnecessary inbound web/network traffic where possible. 3) Check which devices in your business match the affected versions and confirm with your IT person that they are patched or temporarily isolated.

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-47291 is a serious Windows HTTP.sys bug that lets an attacker run code over the network, and you should act quickly if you use the affected Microsoft Windows versions listed—this is RED.

What is it

Windows HTTP.sys is a core “traffic director” that handles web/network requests in Windows. This flaw is caused by an integer math mistake that can be tricked into behaving incorrectly, and that can let an attacker get their code to run. Think of it like a highway toll machine that miscalculates change under certain conditions—an attacker can manipulate the input to make the system do the wrong thing.

Who is affected

This matters to you if you run or rely on these systems for business operations: Microsoft Windows 10 1607, 1809, 21h2, 22h2, and Microsoft Windows 11 23h2, 24h2, 25h2, 26h1. It also affects Microsoft Windows Server 2012 and Microsoft Windows Server 2016. If any of these machines are exposed to the internet or connected networks where attackers could reach them, you’re in the risk zone.

How urgent is it

This is RED because exploitation is reported “itw” (in the wild), including sustained press attention. That means attackers are actively looking for vulnerable systems right now, so waiting increases the chance you get hit. Prioritize patching as soon as possible and make sure exposure is reduced until updates are applied.

What to do — in detail

Identify scope: List every device running the affected versions: Microsoft Windows 10 1607, 1809, 21h2, 22h2; Microsoft Windows 11 23h2, 24h2, 25h2, 26h1; and servers Microsoft Windows Server 2012 and Microsoft Windows Server 2016. Confirm whether any are internet-facing or accessible from untrusted networks.
Patch immediately: Install the relevant Microsoft security update(s) that address CVE-2026-47291 on all affected machines. Reboot if required by the update process and verify updates were applied successfully.
Reduce exposure while patching: If patching takes time, limit inbound traffic to what is necessary. For internet-facing systems, ensure firewall rules deny inbound connections that are not required. If your business uses a reverse proxy/load balancer, ensure the vulnerable host itself is not directly reachable from the internet.
Validate behavior: After patching, confirm the system is stable and that services you run (web/app endpoints) still function.
Monitor: Since exploitation is reported in the wild, keep an eye on unusual network activity and unexpected application behavior on the affected systems. If your IT provider has logging/alerting, ensure events related to network service activity are being collected and reviewed.
Plan ahead: For older end-of-life versions (notably older Windows Server/10 releases), consider migration to supported Windows versions so you are not dependent on repeated emergency patch cycles.

Technical context

Severity is effectively critical for exposed environments: CVSS is listed as 9.8, and the issue is a Windows HTTP.sys remote code execution flaw. Reported exploitation status is “itw” (in the wild) and a named actor is mentioned in press as Nightmare Eclipse (Chaotic Eclipse). However, a CISA KEV entry is “no,” and the provided data says no public exploit is available and no Nuclei detection template exists.

Weakness type is an integer overflow or wraparound in HTTP.sys, which can be abused to achieve unauthorized code execution over a network connection. The attack vector is network-based interaction with the Windows HTTP request handling component (HTTP.sys). EPSS is given as 4.3% estimated probability of exploitation in the next 30 days; that is not the same as “already safe,” and in this case exploitation is reported as active.

About EPSS/KEV: EPSS is an estimate of likelihood of exploitation in the near term; KEV (CISA Known Exploited Vulnerabilities) is a list of vulnerabilities CISA has identified as exploited. For this CVE, KEV status is “no,” but “itw” indicates real-world activity nonetheless.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

25% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

18 events over 138 days, from the signal feeds we watch.

2026-10-25EPSS band changelow → moderateepss band change
2026-10-05EPSS band changemoderate → low
2026-09-30EPSS band changemoderate → low
2026-09-24EPSS band changemoderate → lowepss band change
2026-07-23Patch availablerecord updated
2026-06-29EPSS band changelow → moderate

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation

And 45 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1190Exploit Public-Facing Applicationmedium confidence
Privilege EscalationT1068Exploitation for Privilege Escalationhigh confidence

Sources

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Windows 10 Version 1607, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account